Q1 


Q2 


Q3 


Q4 


We intend to revise the code to address the impact of changes in data protection 
legislation, where these changes are relevant to data sharing. What changes to the 
data protection legislation do you think we should focus on when updating the code? 
The changes to the reasons for processing mean that expanding on these (including special category 


data) would be welcome. A lot of our client's (we are a solicitor's firm) entering information sharing 


agreements and data processing agreements feel that GDPR and DPA 2018 is still relatively vague in 
their descriptions of these gateways. 


Apart from recent changes to data protection legislation, are there other 


developments that are having an impact on your organisation's data sharing practice 
that you would like us to address in the updated code? 


C) Yes 
No 


Please specify 


Does the 2011 data sharing code of practice strike the right balance between 


recognising the benefits of sharing personal data and the need to protect it? Please 
give details. 


0O Yes 
No 


Q5 In what ways does it achieve this? 


Q6 In what ways does it fail to strike the right balance? 


The previous code spends most of its time re-explaining basic data protection 
concepts, with not enough detail being placed on the positive sides of the respective 
legislation - specifically how it allows data sharing in multiple ways legally. 


Q7 What types of data sharing (eg systematic, routine sharing or exceptional, ad hoc 
requests) are covered in too much detail in the 2011 code? 


None, the more detail the better. 


Q8 What types of data sharing (eg systematic, routine sharing or exceptional, ad hoc 
requests) are not covered in enough detail in the 2011 code? 


Exceptional and ad hoc sharing need to be expanded on, potentially giving more 
examples of how this works and what gateways are most likely to be used. 


Q9 Is the 2011 code relevant to the types of data sharing your organisation is involved 
in? If not, which additional areas should we cover? 


Yes. 


Q10 Please provide details of any case studies or data sharing scenarios that you would 
like to see included in the updated code? 


Scenarios - sharing children's data between schools, controller to processor to sub- 
processors in business areas, when to share criminal data as an employer, the 


sharing of data regarding violent/at risk people who may not be best placed to give 
consent. 


Q11 Is there anything the 2011 code does not cover that you think it should? Please 
provide details. 
The sharing of criminal data. 
Q12 


In what other ways do you think the 2011 code could be improved? 


More "grey box" case studies, much like your guidance on FOIA found on your 


website, especially linking to any cases you feel are relevant to the various areas 
covered in the code. 


About you 


Q13 Are you answering these questions as: 
O A public sector worker? 
© A private sector worker? 
O A third or voluntary sector worker? 
O A member of the public 
O A representative of a trade association 
O A data subject 
O An ICO employee 


O Other 


Q1i4 Please specify 


Q15 Please provide more information about the type of organisation you work for, ie a 
bank, a housing association, a school. 


Solcitor's firm (Forbes Solcitors) 


Q16 We may want to contact you about some of the points you have raised. If you are 
happy for us to do this please provide your email address: 


Thank you for taking the time to share your views and experience. 


